Configuration-provider abstraction: standalone appsettings.json + GitHub/Octopus injectors

Part of #332.

Channel/target/environment definitions (sibling issue) must resolve through **pluggable configuration providers**:
- **Standalone** — `appsettings.json` supplies values; Fallout drives CD itself, in lieu of any parent system.
- **Injected** — from a parent system: GitHub (Environments/secrets), Octopus Deploy, Azure DevOps.

This is what lets the same build run inside a forge **or** fully self-hosted. Relates to #252 (`[NeverLiteral]` for env-sourced fields) and the secret conventions in #167. RFC the provider contract + precedence/override rules.